Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| argoproj | argo-workflows | >= 4.0.0, < 4.0.2, < 3.7.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260317T205859-150000.1.152.1 | SUSE-SU-2026:1042-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-pipelines-apiserver +3 | 2.16.0-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/argoproj/argo-workflows | all versions | — | GO-2026-4678 |
| Go | github.com/argoproj/argo-workflows/v2 | all versions | — | GO-2026-4678 |
| Go | github.com/argoproj/argo-workflows/v3 | >= 3.7.0, < 3.7.11 | 3.7.11 | GHSA-56px-hm34-xqj5 |
| Go | github.com/argoproj/argo-workflows/v3 | < 3.7.11 | 3.7.11 | GO-2026-4678 |
| Go | github.com/argoproj/argo-workflows/v4 | < 4.0.2 | 4.0.2 | GHSA-56px-hm34-xqj5 |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:1042-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 26, 2026